Gridcheck, LLC
Document Owner: Gridcheck Executive Leadership
Effective: August 2026
Review Frequency: Annual
Last Reviewed: August 2026
Next Scheduled Review: August 2027
1. Purpose
The purpose of this Change Management Policy is to establish a consistent process for requesting, evaluating, authorizing, testing, implementing, documenting, and validating changes to the Gridcheck platform and supporting infrastructure. The objective is to minimize operational risk while maintaining system reliability, security, and service availability.
2. Scope
This policy applies to changes affecting:
- Gridcheck SaaS applications
- AWS infrastructure
- Production and staging environments
- Security and network configurations (including firewall rules, security groups, and IAM permissions)
- Databases
- Application frameworks
- Third-party software components and dependencies
- Integrations with external services
3. Roles and Responsibilities
Gridcheck executive leadership provides oversight of the change management process.
Authorized technical personnel are responsible for:
- Evaluating proposed changes
- Assessing operational and security impact
- Performing testing
- Coordinating deployments
- Validating successful implementation
All significant changes are tracked within Gridcheck’s issue management system (Redmine).
4. Change Initiation
Changes may originate from:
- Customer requests
- Product enhancements
- Bug fixes
- Security improvements
- Infrastructure maintenance
- Vendor updates
- Regulatory or compliance requirements
Each significant change is documented within Redmine.
5. Impact Assessment
Prior to implementation, significant changes are evaluated to determine their potential impact on:
- System availability
- Security
- Customer functionality
- Data integrity
- Performance
- Existing integrations
Changes are prioritized based on operational importance, customer impact, and security considerations.
6. Authorization
Significant production changes require internal review and authorization before implementation.
Authorization considers:
- Business justification
- Risk
- Testing status
- Deployment timing
Authorization for changes affecting firewall rules, security groups, IAM permissions, network security controls, and other critical production infrastructure is limited to authorized personnel, including Executive Leadership, the Director of Engineering (or Engineering Manager), and authorized System Administrators, as appropriate to the nature and scope of the change.
Emergency changes follow the procedures described in Gridcheck’s Patch Management Policy.
7. Testing and Validation
Where practical:
- Changes are deployed to a staging environment.
- Functional and regression testing are performed.
- Security impacts are evaluated when appropriate.
- Production deployments are validated following implementation.
Only changes that have successfully completed appropriate validation are promoted to production.
8. Production Deployment
Production deployments are performed in a controlled manner intended to minimize customer impact.
Where feasible:
- Deployments are scheduled during lower-usage periods.
- Customer impact is minimized.
- System operation is verified following deployment.
9. Emergency Changes
Emergency changes necessary to address active security risks or restore service availability may be implemented on an expedited basis.
When prior authorization is not practical:
- The change is documented.
- Management review is completed after implementation.
- Appropriate authorization is recorded.
- Validation and follow-up activities are documented within Redmine.
10. Documentation
For significant production changes, Redmine records typically include:
- Description of the change
- Reason for implementation
- Date of deployment
- Environment affected
- Authorization
- Validation outcome
- Related follow-up actions, when applicable
11. Related Policies
This policy supports and should be read together with Gridcheck’s:
- Software Development Life Cycle (SDLC)
- Patch Management Policy
- Information Security Policy
- Disaster Recovery Plan
- Business Continuity Plan
12. Review
This Change Management Policy is reviewed annually and following significant operational or infrastructure changes.